Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c4153a6

Browse files
erik-krogherik-krogh
committed
remove duplicated test cases from ReDoS, and adjust variables names to match test output
1 parent 8270bf5 commit c4153a6

4 files changed

Lines changed: 27 additions & 45 deletions

File tree

‎javascript/ql/src/Performance/ReDoS.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ private module CharacterClasses {
306306
* Gets a char that could be matched by a regular expression.
307307
* Includes all printable ascii chars, all constants mentioned in a regexp, and all chars matches by the regexp `/\s|\d|\w/`.
308308
*/
309-
private string getARelevantChar() {
309+
string getARelevantChar() {
310310
exists(ascii(result))
311311
or
312312
exists(RegexpCharacterConstant c | result = c.getValue().charAt(_))

‎javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected‎

Lines changed: 18 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -181,8 +181,8 @@
181181
| regexplib/uri.js:59:2:59:13 | [a-zA-Z]{3,} | it can start matching anywhere |
182182
| regexplib/uri.js:64:31:64:36 | [\\w-]+ | it can start matching anywhere after the start of the preceeding '[\\w-\\s]*' |
183183
| regexplib/uri.js:73:2:73:4 | .*? | it can start matching anywhere |
184-
| tst.js:14:13:14:18 | (.*,)+ | it can start matching anywhere |
185-
| tst.js:14:14:14:15 | .* | it can start matching anywhere |
184+
| tst.js:14:14:14:19 | (.*,)+ | it can start matching anywhere |
185+
| tst.js:14:15:14:16 | .* | it can start matching anywhere |
186186
| tst.js:47:15:47:37 | (?:[^"']\|".*?"\|'.*?')*? | it can start matching anywhere |
187187
| tst.js:47:25:47:27 | .*? | it can start matching anywhere after the start of the preceeding '"' |
188188
| tst.js:47:31:47:33 | .*? | it can start matching anywhere after the start of the preceeding ''' |
@@ -247,24 +247,21 @@
247247
| tst.js:224:16:224:23 | ([^X]b)+ | it can start matching anywhere |
248248
| tst.js:227:14:227:24 | (([^X]b)+)* | it can start matching anywhere |
249249
| tst.js:227:15:227:22 | ([^X]b)+ | it can start matching anywhere |
250-
| tst.js:230:15:230:20 | (.*,)+ | it can start matching anywhere |
251-
| tst.js:230:16:230:17 | .* | it can start matching anywhere |
250+
| tst.js:230:15:230:22 | ((ab)+)* | it can start matching anywhere |
251+
| tst.js:230:16:230:20 | (ab)+ | it can start matching anywhere |
252252
| tst.js:233:15:233:22 | ((ab)+)* | it can start matching anywhere |
253253
| tst.js:233:16:233:20 | (ab)+ | it can start matching anywhere |
254-
| tst.js:236:15:236:22 | ((ab)+)* | it can start matching anywhere |
255-
| tst.js:236:16:236:20 | (ab)+ | it can start matching anywhere |
256-
| tst.js:242:14:242:21 | ((ab)+)* | it can start matching anywhere |
257-
| tst.js:242:15:242:19 | (ab)+ | it can start matching anywhere |
258-
| tst.js:245:15:245:22 | ((ab)+)* | it can start matching anywhere |
259-
| tst.js:245:16:245:20 | (ab)+ | it can start matching anywhere |
260-
| tst.js:248:14:248:23 | ([\\n\\s]+)* | it can start matching anywhere |
261-
| tst.js:248:15:248:21 | [\\n\\s]+ | it can start matching anywhere |
262-
| tst.js:251:16:251:17 | A* | it can start matching anywhere |
263-
| tst.js:251:18:251:19 | A* | it can start matching anywhere |
264-
| tst.js:251:18:251:19 | A* | it can start matching anywhere after the start of the preceeding 'A*' |
265-
| tst.js:260:14:260:21 | (\\n\\s*)+ | it can start matching anywhere |
266-
| tst.js:266:14:266:91 | (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+ | it can start matching anywhere |
267-
| tst.js:266:15:266:17 | \\w* | it can start matching anywhere |
268-
| tst.js:269:14:269:116 | (.thisisagoddamnlongstringforstresstestingthequery\|\\sthisisagoddamnlongstringforstresstestingthequery)* | it can start matching anywhere |
269-
| tst.js:272:14:272:77 | (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* | it can start matching anywhere |
270-
| tst.js:275:15:275:117 | (thisisagoddamnlongstringforstresstestingthequery\|imanotherbutunrelatedstringcomparedtotheotherstring)* | it can start matching anywhere |
254+
| tst.js:239:14:239:21 | ((ab)+)* | it can start matching anywhere |
255+
| tst.js:239:15:239:19 | (ab)+ | it can start matching anywhere |
256+
| tst.js:242:15:242:22 | ((ab)+)* | it can start matching anywhere |
257+
| tst.js:242:16:242:20 | (ab)+ | it can start matching anywhere |
258+
| tst.js:245:14:245:23 | ([\\n\\s]+)* | it can start matching anywhere |
259+
| tst.js:245:15:245:21 | [\\n\\s]+ | it can start matching anywhere |
260+
| tst.js:248:16:248:17 | A* | it can start matching anywhere |
261+
| tst.js:248:18:248:19 | A* | it can start matching anywhere |
262+
| tst.js:248:18:248:19 | A* | it can start matching anywhere after the start of the preceeding 'A*' |
263+
| tst.js:254:14:254:91 | (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+ | it can start matching anywhere |
264+
| tst.js:254:15:254:17 | \\w* | it can start matching anywhere |
265+
| tst.js:257:14:257:116 | (.thisisagoddamnlongstringforstresstestingthequery\|\\sthisisagoddamnlongstringforstresstestingthequery)* | it can start matching anywhere |
266+
| tst.js:260:14:260:77 | (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* | it can start matching anywhere |
267+
| tst.js:263:15:263:117 | (thisisagoddamnlongstringforstresstestingthequery\|imanotherbutunrelatedstringcomparedtotheotherstring)* | it can start matching anywhere |

‎javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -108,11 +108,8 @@
108108
| tst.js:218:15:218:19 | [^X]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'W'. |
109109
| tst.js:221:20:221:20 | b | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'bW'. |
110110
| tst.js:227:20:227:20 | b | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'bW'. |
111-
| tst.js:242:16:242:17 | ab | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'ab'. |
112-
| tst.js:248:15:248:21 | [\\n\\s]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\n'. |
113-
| tst.js:254:17:254:21 | [^>]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
114-
| tst.js:257:16:257:21 | [^>a]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '='. |
115-
| tst.js:260:17:260:19 | \\s* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\n'. |
116-
| tst.js:266:87:266:89 | \\w* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz'. |
117-
| tst.js:269:14:269:116 | (.thisisagoddamnlongstringforstresstestingthequery\|\\sthisisagoddamnlongstringforstresstestingthequery)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ' thisisagoddamnlongstringforstresstestingthequery'. |
118-
| tst.js:272:14:272:77 | (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'thisisagoddamnlongstringforstresstestingthequery'. |
111+
| tst.js:239:16:239:17 | ab | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'ab'. |
112+
| tst.js:245:15:245:21 | [\\n\\s]+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '\\n'. |
113+
| tst.js:254:87:254:89 | \\w* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of '0foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz'. |
114+
| tst.js:257:14:257:116 | (.thisisagoddamnlongstringforstresstestingthequery\|\\sthisisagoddamnlongstringforstresstestingthequery)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of ' thisisagoddamnlongstringforstresstestingthequery'. |
115+
| tst.js:260:14:260:77 | (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'thisisagoddamnlongstringforstresstestingthequery'. |

‎javascript/ql/test/query-tests/Performance/ReDoS/tst.js‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ var good1 = /^\b_((?:__|[^_])+?)_\b|^\*((?:\*\*|[^*])+?)\*(?!\*)/;
1111
// GOOD - there is no witness in the end that could cause the regexp to not match
1212
// Adapted from brace-expansion (https://github.com/juliangruber/brace-expansion),
1313
// which is licensed under the MIT license; see file brace-expansion-LICENSE.
14-
var bad2 = /(.*,)+.+/;
14+
var good2 = /(.*,)+.+/;
1515

1616
// NOT GOOD; attack: " '" + "\\\\".repeat(100)
1717
// Adapted from CodeMirror (https://github.com/codemirror/codemirror),
1818
// which is licensed under the MIT license; see file CodeMirror-LICENSE.
19-
var bad3 = /^(?:\s+(?:"(?:[^"\\]|\\\\|\\.)+"|'(?:[^'\\]|\\\\|\\.)+'|\((?:[^)\\]|\\\\|\\.)+\)))?/;
19+
var bad2 = /^(?:\s+(?:"(?:[^"\\]|\\\\|\\.)+"|'(?:[^'\\]|\\\\|\\.)+'|\((?:[^)\\]|\\\\|\\.)+\)))?/;
2020

2121
// GOOD
2222
// Adapted from lulucms2 (https://github.com/yiifans/lulucms2).
@@ -95,7 +95,7 @@ var good9 = '(a|aa?)*b';
9595
var bad18 = /(([^]|[^a])*)"/;
9696

9797
// GOOD - there is no witness in the end that could cause the regexp to not match
98-
var bad19 = /([^"']+)*/g;
98+
var good10 = /([^"']+)*/g;
9999

100100
// NOT GOOD
101101
var bad20 = /((.|[^a])*)"/;
@@ -226,9 +226,6 @@ var good18 = /(([^X]b)+)*($|[^X]b)/;
226226
// NOT GOOD
227227
var bad54 = /(([^X]b)+)*($|[^X]c)/;
228228

229-
// GOOD
230-
var good19 = /(.*,)+.+/;
231-
232229
// GOOD
233230
var good20 = /((ab)+)*ababab/;
234231

@@ -250,15 +247,6 @@ var bad56 = /([\n\s]+)*(.)/;
250247
// GOOD - any witness passes through the accept state.
251248
var good24 = /(A*A*X)*/;
252249

253-
// GOOD - but still flagged (always matches something)
254-
var good25 = /^([^>]+)*(>|$)/;
255-
256-
// NOT GOOD
257-
var bad57 = /^([^>a]+)*(>|$)/;
258-
259-
// NOT GOOD
260-
var bad58 = /(\n\s*)+$/;
261-
262250
// GOOD
263251
var good26 = /([^\\\]]+)*/
264252

0 commit comments

Comments
 (0)